2021 CVEs (page 211)
Page 211 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-23959 | Medium | 6.1 | 2021-02-26 | An XSS bug in internal error pages could have led to various spoofing attacks, including other error pages and the address bar. Note: This issue only affected… |
CVE-2021-23958 | Medium | 6.5 | 2021-02-26 | The browser could have been confused into transferring a screen sharing state into another tab, which would leak unintended information. This vulnerability aff… |
CVE-2021-23957 | High | 7.4 | 2021-02-26 | Navigations through the Android-specific `intent` URL scheme could have been misused to escape iframe sandbox. Note: This issue only affected Firefox for Andro… |
CVE-2021-23956 | Medium | 6.5 | 2021-02-26 | An ambiguous file picker design could have confused users who intended to select and upload a single file into uploading a whole directory. This was addressed… |
CVE-2021-23955 | Medium | 6.1 | 2021-02-26 | The browser could have been confused into transferring a pointer lock state into another tab, which could have lead to clickjacking attacks. This vulnerability… |
CVE-2021-23954 | High | 8.8 | 2021-02-26 | Using the new logical assignment operators in a JavaScript switch statement could have caused a type confusion, leading to a memory corruption and a potentiall… |
CVE-2021-23953 | Medium | 4.3 | 2021-02-26 | If a user clicked into a specifically crafted PDF, the PDF reader could be confused into leaking cross-origin information, when said information is served as c… |
CVE-2021-21724 | Medium | 4.4 | 2021-02-26 | A ZTE product has a memory leak vulnerability. Due to the product's improper handling of memory release in certain scenarios, a local attacker with device perm… |
CVE-2021-21330 | Low | 3.1 | 2021-02-26 | aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In aiohttp before version 3.7.4 there is an open redirect vulnerability. A mali… |
CVE-2021-23976 | High | 8.1 | 2021-02-26 | When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp mani… |
CVE-2021-23975 | Medium | 6.5 | 2021-02-26 | The developer page about:memory has a Measure function for exploring what object types the browser has allocated and their sizes. When this function was invoke… |
CVE-2021-23974 | Medium | 6.1 | 2021-02-26 | The DOMParser API did not properly process '<noscript>' elements for escaping. This could be used as an mXSS vector to bypass an HTML Sanitizer. This vulnerabi… |
CVE-2021-23973 | Medium | 6.5 | 2021-02-26 | When trying to load a cross-origin resource in an audio/video context a decoding error may have resulted, and the content of that error may have revealed infor… |
CVE-2021-23972 | High | 8.8 | 2021-02-26 | One phishing tactic on the web is to provide a link with HTTP Auth. For example 'https://www.phishingtarget.com@evil.com'. To mitigate this type of attack, Fir… |
CVE-2021-23971 | Medium | 6.5 | 2021-02-26 | When processing a redirect with a conflicting Referrer-Policy, Firefox would have adopted the redirect's Referrer-Policy. This would have potentially resulted… |
CVE-2021-23970 | Medium | 6.5 | 2021-02-26 | Context-specific code was included in a shared jump table; resulting in assertions being triggered in multithreaded wasm code. This vulnerability affects Firef… |
CVE-2021-23969 | Medium | 4.3 | 2021-02-26 | As specified in the W3C Content Security Policy draft, when creating a violation report, "User agents need to ensure that the source file is the URL requested… |
CVE-2021-23968 | Medium | 4.3 | 2021-02-26 | If Content Security Policy blocked frame navigation, the full destination of a redirect served in the frame was reported in the violation report; as opposed to… |
CVE-2021-21328 | Medium | 5.3 | 2021-02-26 | Vapor is a web framework for Swift. In Vapor before version 4.40.1, there is a DoS attack against anyone who Bootstraps a metrics backend for their Vapor app… |
CVE-2021-26701 | High | 8.1 | 2021-02-25 | .NET Core Remote Code Execution Vulnerability |
CVE-2021-26700 | High | 7.8 | 2021-02-25 | Visual Studio Code npm-script Extension Remote Code Execution Vulnerability |
CVE-2021-25195 | High | 7.8 | 2021-02-25 | Windows PKU2U Elevation of Privilege Vulnerability |
CVE-2021-24114 | Medium | 5.7 | 2021-02-25 | Microsoft Teams iOS Information Disclosure Vulnerability |
CVE-2021-24113 | Medium | 5.4 | 2021-02-25 | Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability |
CVE-2021-24112 | High | 8.1 | 2021-02-25 | .NET Core Remote Code Execution Vulnerability |
CVE-2021-24111 | High | 7.5 | 2021-02-25 | .NET Framework Denial of Service Vulnerability |
CVE-2021-24109 | Medium | 6.8 | 2021-02-25 | Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability |
CVE-2021-24106 | Medium | 5.5 | 2021-02-25 | Windows DirectX Information Disclosure Vulnerability |
CVE-2021-24105 | High | 8.4 | 2021-02-25 | <p>Depending on configuration of various package managers it is possible for an attacker to insert a malicious package into a package manager's repository whic… |
CVE-2021-24103 | High | 7.8 | 2021-02-25 | Windows Event Tracing Elevation of Privilege Vulnerability |
CVE-2021-24102 | High | 7.8 | 2021-02-25 | Windows Event Tracing Elevation of Privilege Vulnerability |
CVE-2021-24101 | Medium | 6.5 | 2021-02-25 | Microsoft Dataverse Information Disclosure Vulnerability |
CVE-2021-24100 | Medium | 5.0 | 2021-02-25 | Microsoft Edge for Android Information Disclosure Vulnerability |
CVE-2021-24099 | Medium | 6.5 | 2021-02-25 | Skype for Business and Lync Denial of Service Vulnerability |
CVE-2021-24098 | Medium | 5.5 | 2021-02-25 | Windows Console Driver Denial of Service Vulnerability |
CVE-2021-24096 | High | 7.8 | 2021-02-25 | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2021-24094 | Critical | 9.8 | 2021-02-25 | Windows TCP/IP Remote Code Execution Vulnerability |
CVE-2021-24093 | High | 8.8 | 2021-02-25 | Windows Graphics Component Remote Code Execution Vulnerability |
CVE-2021-24092 | High | 7.8 | 2021-02-25 | Microsoft Defender Elevation of Privilege Vulnerability |
CVE-2021-24091 | High | 7.8 | 2021-02-25 | Windows Camera Codec Pack Remote Code Execution Vulnerability |
CVE-2021-24088 | High | 8.8 | 2021-02-25 | Windows Local Spooler Remote Code Execution Vulnerability |
CVE-2021-24087 | High | 7.0 | 2021-02-25 | Azure IoT CLI extension Elevation of Privilege Vulnerability |
CVE-2021-24086 | High | 7.5 | 2021-02-25 | Windows TCP/IP Denial of Service Vulnerability |
CVE-2021-24085 | Medium | 6.5 | 2021-02-25 | Microsoft Exchange Server Spoofing Vulnerability |
CVE-2021-24084 | Medium | 5.5 | 2021-02-25 | Windows Mobile Device Management Information Disclosure Vulnerability |
CVE-2021-24083 | High | 7.8 | 2021-02-25 | Windows Address Book Remote Code Execution Vulnerability |
CVE-2021-24082 | Medium | 4.3 | 2021-02-25 | Microsoft.PowerShell.Utility Module WDAC Security Feature Bypass Vulnerability |
CVE-2021-24081 | High | 7.8 | 2021-02-25 | Microsoft Windows Codecs Library Remote Code Execution Vulnerability |
CVE-2021-24080 | Medium | 6.5 | 2021-02-25 | Windows Trust Verification API Denial of Service Vulnerability |
CVE-2021-24079 | Medium | 5.5 | 2021-02-25 | Windows Backup Engine Information Disclosure Vulnerability |
CVE-2021-24078 | Critical | 9.8 | 2021-02-25 | Windows DNS Server Remote Code Execution Vulnerability |
CVE-2021-24077 | Critical | 9.8 | 2021-02-25 | Windows Fax Service Remote Code Execution Vulnerability |
CVE-2021-24076 | Medium | 5.5 | 2021-02-25 | Microsoft Windows VMSwitch Information Disclosure Vulnerability |
CVE-2021-24075 | Medium | 6.8 | 2021-02-25 | Microsoft Windows VMSwitch Denial of Service Vulnerability |
CVE-2021-24074 | Critical | 9.8 | 2021-02-25 | Windows TCP/IP Remote Code Execution Vulnerability |
CVE-2021-24073 | Medium | 6.5 | 2021-02-25 | Skype for Business and Lync Spoofing Vulnerability |
CVE-2021-24072 | High | 8.8 | 2021-02-25 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
CVE-2021-24071 | Medium | 5.3 | 2021-02-25 | Microsoft SharePoint Information Disclosure Vulnerability |
CVE-2021-24070 | High | 7.8 | 2021-02-25 | Microsoft Excel Remote Code Execution Vulnerability |
CVE-2021-24069 | High | 7.8 | 2021-02-25 | Microsoft Excel Remote Code Execution Vulnerability |
CVE-2021-24068 | High | 7.8 | 2021-02-25 | Microsoft Excel Remote Code Execution Vulnerability |
CVE-2021-24067 | High | 7.8 | 2021-02-25 | Microsoft Excel Remote Code Execution Vulnerability |
CVE-2021-24066 | High | 8.8 | 2021-02-25 | Microsoft SharePoint Remote Code Execution Vulnerability |
CVE-2021-1734 | High | 7.5 | 2021-02-25 | Windows Remote Procedure Call Information Disclosure Vulnerability |
CVE-2021-1733 | High | 7.8 | 2021-02-25 | Sysinternals PsExec Elevation of Privilege Vulnerability |
CVE-2021-1732 | High | 7.8 | 2021-02-25 | Windows Win32k Elevation of Privilege Vulnerability |
CVE-2021-1731 | Medium | 5.5 | 2021-02-25 | PFX Encryption Security Feature Bypass Vulnerability |
CVE-2021-1730 | Medium | 5.4 | 2021-02-25 | <p>A spoofing vulnerability exists in Microsoft Exchange Server which could result in an attack that would allow a malicious actor to impersonate the user.</p>… |
CVE-2021-1728 | High | 8.8 | 2021-02-25 | System Center Operations Manager Elevation of Privilege Vulnerability |
CVE-2021-1727 | High | 7.8 | 2021-02-25 | Windows Installer Elevation of Privilege Vulnerability |
CVE-2021-1726 | High | 8.0 | 2021-02-25 | Microsoft SharePoint Server Spoofing Vulnerability |
CVE-2021-1724 | Medium | 6.1 | 2021-02-25 | Microsoft Dynamics Business Central Cross-site Scripting Vulnerability |
CVE-2021-1722 | High | 8.1 | 2021-02-25 | Windows Fax Service Remote Code Execution Vulnerability |
CVE-2021-1721 | Medium | 6.5 | 2021-02-25 | .NET Core and Visual Studio Denial of Service Vulnerability |
CVE-2021-1698 | High | 7.8 | 2021-02-25 | Windows Win32k Elevation of Privilege Vulnerability |
CVE-2021-1639 | High | 7.0 | 2021-02-25 | Visual Studio Code Remote Code Execution Vulnerability |
CVE-2021-3406 | Critical | 9.8 | 2021-02-25 | A flaw was found in keylime 5.8.1 and older. The issue in the Keylime agent and registrar code invalidates the cryptographic chain of trust from the Endorsemen… |
CVE-2021-20203 | Low | 3.2 | 2021-02-25 | An integer overflow issue was found in the vmxnet3 NIC emulator of the QEMU for versions up to v5.2.0. It may occur if a guest was to supply invalid values for… |
CVE-2021-20328 | Medium | 6.4 | 2021-02-25 | Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server’s… |
CVE-2021-20327 | Medium | 6.4 | 2021-02-25 | A specific version of the Node.js mongodb-client-encryption module does not perform correct validation of the KMS server’s certificate. This vulnerability in c… |
CVE-2021-27330 | Medium | 6.1 | 2021-02-25 | Triconsole Datepicker Calendar <3.77 is affected by cross-site scripting (XSS) in calendar_form.php. Attackers can read authentication cookies that are still a… |
CVE-2021-3124 | Medium | 5.4 | 2021-02-25 | Stored cross-site scripting (XSS) in form field in robust.systems product Custom Global Variables v 1.0.5 allows a remote attacker to inject arbitrary code via… |
CVE-2021-3273 | High | 7.2 | 2021-02-25 | Nagios XI below 5.7 is affected by code injection in the /nagiosxi/admin/graphtemplates.php component. To exploit this vulnerability, someone must have an admi… |
CVE-2021-21066 | High | 7.8 | 2021-02-25 | Adobe Bridge version 11.0 (and earlier) is affected by an out-of-bounds write vulnerability when parsing TTF files that could result in arbitrary code executio… |
CVE-2021-21065 | High | 7.8 | 2021-02-25 | Adobe Bridge version 11.0 (and earlier) is affected by an out-of-bounds write vulnerability when parsing TTF files that could result in arbitrary code executio… |
CVE-2021-21064 | Medium | 4.9 | 2021-02-25 | Magento UPWARD-php version 1.1.4 (and earlier) is affected by a Path traversal vulnerability in Magento UPWARD Connector version 1.1.2 (and earlier) due to the… |
CVE-2021-27671 | Medium | 6.1 | 2021-02-25 | An issue was discovered in the comrak crate before 0.9.1 for Rust. XSS can occur because the protection mechanism for data: and javascript: URIs is case-sensit… |
CVE-2021-27670 | Critical | 9.8 | 2021-02-25 | Appspace 6.2.4 allows SSRF via the api/v1/core/proxy/jsonprequest url parameter. |
CVE-2021-1450 | Medium | 5.5 | 2021-02-24 | A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client could allow an authenticated, local attacker to caus… |
CVE-2021-1396 | Critical | 9.8 | 2021-02-24 | Multiple vulnerabilities in Cisco Application Services Engine could allow an unauthenticated, remote attacker to gain privileged access to host-level operation… |
CVE-2021-1393 | Critical | 9.8 | 2021-02-24 | Multiple vulnerabilities in Cisco Application Services Engine could allow an unauthenticated, remote attacker to gain privileged access to host-level operation… |
CVE-2021-1388 | Critical | 10.0 | 2021-02-24 | A vulnerability in an API endpoint of Cisco ACI Multi-Site Orchestrator (MSO) installed on the Application Services Engine could allow an unauthenticated, remo… |
CVE-2021-1387 | High | 8.6 | 2021-02-24 | A vulnerability in the network stack of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an… |
CVE-2021-1368 | High | 8.8 | 2021-02-24 | A vulnerability in the Unidirectional Link Detection (UDLD) feature of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adjacent at… |
CVE-2021-1367 | Medium | 4.3 | 2021-02-24 | A vulnerability in the Protocol Independent Multicast (PIM) feature of Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a denial… |
CVE-2021-1361 | Critical | 9.8 | 2021-02-24 | A vulnerability in the implementation of an internal file management service for Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in stand… |
CVE-2021-1231 | Medium | 4.7 | 2021-02-24 | A vulnerability in the Link Layer Discovery Protocol (LLDP) for Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode could allow… |
CVE-2021-1230 | High | 8.6 | 2021-02-24 | A vulnerability with the Border Gateway Protocol (BGP) for Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode could allow… |
CVE-2021-1229 | Medium | 5.8 | 2021-02-24 | A vulnerability in ICMP Version 6 (ICMPv6) processing in Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a slow system memory lea… |
CVE-2021-1228 | High | 7.4 | 2021-02-24 | A vulnerability in the fabric infrastructure VLAN connection establishment of Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (AC… |